trwa-sushi[.]top

The domain trwa-sushi.top is a phishing site engaged in brand impersonation targeting users of the cryptocurrency platform SushiSwap. It was designed to deceive victims into believing they were interacting with the legitimate SushiSwap service, posing an elevated risk of cryptocurrency scams. As of the latest verification, trwa-sushi.top has been taken offline, but it previously operated without a known drainer kit.

Technical indicators confirm the malicious nature of trwa-sushi.top. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft and Trustwave, with a Gridinsoft trust score of 0/100. It appeared on 4 security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. Registered through NameCheap, Inc. on August 30, 2025, the domain resolved to the IPv6 address 2a06:98c1:3121::3, hosted on Cloudflare's network (AS13335) in the US. No SSL certificate was present, and the observed page title was 'Nur einen Moment…'. Nameservers were celeste.ns.cloudflare.com and kareem.ns.cloudflare.com.

Individuals who interacted with trwa-sushi.top should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new cryptocurrency wallet. Monitor transaction histories for unauthorized activity and report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand’s official security channels. If credentials were entered, change passwords on the legitimate SushiSwap platform and enable two-factor authentication.